Document initial Gitea deployment and team access; refs #1

chapters/devopsPasswords.tex

@@ -42,14 +42,17 @@ only where a generated secret cannot be retrieved.
 \multicolumn{4}{l}{\small\itshape Account, Server, and Password Rule Register (continued)}\\
 \toprule \textbf{User} & \textbf{Server or service} & \textbf{Class} & \textbf{Rule and hint}\\ \midrule
 \endhead \bottomrule \endlastfoot
+\texttt{victor} & Gitea (Inviscid) & Unique & Site administrator; password kept outside this report and repository.\\
+\texttt{payton} & Gitea (Inviscid) & Temporary & Initial password delivered separately; mandatory change configured. First-login completion pending confirmation.\\
+Both authors & EC2 \texttt{ubuntu} & SSH key & Separate private keys remain on each author's workstation; only public keys authorized on EC2. No private keys in Git.\\
 \texttt{root} & \texttt{ssw590-dev-01} & None & No password. Administrative access is obtained through \texttt{sudo} by a named account, so that privileged actions are attributable.\\
 \texttt{payton} & \texttt{ssw590-dev-01}, \texttt{ssw590-build-01} & Derived & Used only to authenticate \texttt{sudo}; \gls{ssh} password authentication is disabled, so this secret never crosses the network.
 \textit{Psst... sudo is a name, no?}\\
 \texttt{ssw-app} & \texttt{ssw590-dev-01} & Generated & Unprivileged service account for course applications. Secret held in a file readable only by that account, excluded from the repository, and rotated per deployment.\\
 Master & Password manager vault & Derived & A memorized password that isn't stored in its own vault.
 \textit{Surely it's secure, no lie?}\\
-Root user & AWS account & Generated & Reserved for account recovery and billing; \gls{mfa} enforced, not used for routine work.\\
-\texttt{payton-admin} & AWS console, \gls{iam} & Generated & Day-to-day console account. \gls{mfa} enforced. Programmatic access uses short-lived credentials rather than a stored key pair.\\
+Root user & AWS account & Generated & Existing account policy: recovery and billing. Victor previously reported administrative root use and deferred MFA; current MFA state not verified.\\
+Payton & AWS console, Identity Center & Separate identity & EC2 permission set configured previously; current MFA state not verified.\\
 \end{tabularx}
 
 \section{Handling and Storage}
@@ -60,7 +63,7 @@ The following rules apply to every entry above.
 \begin{itemize}[leftmargin=*]
 \item No password, private key, access token, or recovery code is recorded anywhere non-secure.
       A secret is referred to by the location that holds it.
-\item \gls{mfa} is enabled on every account that supports it.
+\item Target policy: enable \gls{mfa} wherever supported. This is not a claim that every current account has been verified as compliant.
 \item A generated password is rotated by replacement. Any password is
       rotated immediately if it is disclosed, and knowing one password
       does not provide insight into other passwords.